3 ms·
All these attack vectors work regardless of the Authentication system used.
by usrbinbash 5y ago
All these attack vectors work regardless of the Authentication system used.
- yuliyp 5y agoThey don't, though. Users don't reuse session cookies between sites, so another site compromised doesn't mean you have to worry about existing sessions being compromised on your site. Users also don't know their session cookies so are far less likely to go typing them in to a phishing site or hand them out over the phone. A password is vulnerable to all of these scenarios.